container.dockleDockle
Runs Dockle on an image (image:<ref>): CIS Docker Benchmark checks on image config and contents (root user, secrets in ENV or files, setuid files, ADD, latest tag). Dockle pulls the image from its registry when it is not available locally.
- Engine
- Wrapped scanner
- Wraps
dockle- Targets
- Container
- Areas
- Security, Best practices
- Runs
- Opt-in: only when selected with --only
- Network
- Contacts services beyond the target
Run only this auditor
bunx openaudit image:nginx:1.27 --only container.dockleWraps dockle. When it isn't installed, the auditor is skipped with an install hint and the rest of the audit runs.